evennia.web.api.permissions

class evennia.web.api.permissions.EvenniaPermission[source]

Bases: rest_framework.permissions.BasePermission

A Django Rest Framework permission class that allows us to use Evennia’s permission structure. Based on the action in a given view, we’ll check a corresponding Evennia access/lock check.

MINIMUM_LIST_PERMISSION = 'builder'
MINIMUM_CREATE_PERMISSION = 'builder'
view_locks = ['examine']
destroy_locks = ['delete']
update_locks = ['control', 'edit']
has_permission(request, view)[source]

Checks for permissions

Parameters
  • request (Request) – The incoming request object.

  • view (View) – The django view we are checking permission for.

Returns

bool – If permission is granted or not. If we return False here, a PermissionDenied error will be raised from the view.

Notes

This method is a check that always happens first. If there’s an object involved, such as with retrieve, update, or delete, then the has_object_permission method is called after this, assuming this returns True.

static check_locks(obj, user, locks)[source]

Checks access for user for object with given locks :param obj: Object instance we’re checking :param user: User who we’re checking permissions :type user: Account :param locks: list of lockstrings :type locks: list

Returns

bool – True if they have access, False if they don’t

has_object_permission(request, view, obj)[source]

Checks object-level permissions after has_permission

Parameters
  • request (Request) – The incoming request object.

  • view (View) – The django view we are checking permission for.

  • obj – Object we’re checking object-level permissions for

Returns

bool – If permission is granted or not. If we return False here, a PermissionDenied error will be raised from the view.

Notes

This method assumes that has_permission has already returned True. We check equivalent Evennia permissions in the request.user to determine if they can complete the action.